Project Overview
Built an automated security posture pipeline to detect configuration drift across unmanaged infrastructure and surface risk in real time via a centralized Splunk dashboard. The system combined AWS infrastructure scanning, Python/Bash automation, and GRC framework alignment to move from reactive, manual security reviews to continuous, automated visibility.
Project Timeline
Tech Stack
Problem Statement
Unmanaged servers across the infrastructure were drifting from approved security configurations with no automated mechanism to detect or alert on those changes. The lack of centralized visibility meant that configuration deviations — open ports, weakened IAM policies, disabled logging — could persist undetected, creating an expanding unauthorized access risk surface with no clear remediation trigger.
Approach & Solution
Posture-Mapping Pipelines
Built AWS enumeration scripts that captured the live configuration state of all in-scope resources and compared against defined security baselines.
Automated Drift Detection
Python and Bash automation continuously ran posture checks on a scheduled cadence, generating structured findings for any configuration that deviated from baseline.
Real-Time Splunk Dashboard
Forwarded all findings to Splunk where a purpose-built dashboard provided real-time risk visibility, alert severity classification, and trend tracking.
Remediation Playbooks
Authored step-by-step remediation playbooks for each finding category, enabling self-service resolution and reducing mean time to remediate.
Key Outcomes
Lessons Learned
- Automation without documentation creates knowledge silos — the pipeline only delivered lasting value when paired with runbooks that let any team member act on its findings independently.
- Dashboard visibility is the bridge between technical findings and business action; raw alert data without visualization fails to drive prioritization at the management level.
- GRC alignment from the start — not retrofitted at the end — is what turns a technical detection tool into a compliance-grade security control.